knox MIT 42 versions

knox

npm Repository Homepage

Amazon S3 client

42

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

tjholowaychukdomenic

Keywords

awsamazons3

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-added	AI (maintainer-change): domenic is Domenic Denicola, already a listed contributor in package.json; this is a username consolidation, not a hostile takeover.	ai	2026/04/24
maintainer-change	maintainer-removed	AI (maintainer-change): domenicdenicola and domenic are the same person (Domenic Denicola); removal of old username is benign.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): xml2js is a well-known XML parsing library; its addition is appropriate for an S3 client that parses XML API responses.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change (tjholowaychuk → domenic) occurred in 2013; domenic is listed as a contributor in package.json and has a strong track record. Legitimate historical maintainer transition.	ai	2026/04/24
typosquat	typosquat.levenshtein:knex	AI (typosquat): knox is a legitimate S3 client package (not a knex typosquat) with 75k weekly downloads and 45 versions; the levenshtein proximity is coincidental for this namespace.	ai	2026/04/24

Versions (showing 42 of 42)

Version	Deps	Published
0.9.2	5 / 1	2015-01-05
0.9.1	5 / 1	2014-08-25
0.9.0	5 / 1	2014-06-11
0.8.10	4 / 1	2014-05-11
0.8.9	4 / 1	2014-02-08
0.8.8	4 / 1	2013-11-28
0.8.7	4 / 1	2013-11-22
0.8.6	4 / 1	2013-08-01
0.8.5	4 / 1	2013-07-29
0.8.4	4 / 1	2013-07-13
0.8.3	4 / 1	2013-06-09
0.8.2	4 / 1	2013-05-21
0.8.1	4 / 1	2013-05-20
0.8.0	4 / 1	2013-05-06
0.7.1	4 / 1	2013-05-02
0.7.0	4 / 1	2013-04-09
0.6.0	3 / 1	2013-03-25
0.5.5	3 / 1	2013-03-18
0.5.4	3 / 1	2013-02-28
0.5.3	3 / 1	2013-02-16
0.5.2	3 / 1	2013-02-05
0.5.0	2 / 1	2013-01-25
0.4.7	2 / 1	2013-01-23
0.4.6	2 / 1	2012-12-22
0.4.5	2 / 1	2012-12-16
0.4.4	2 / 1	2012-12-09
0.4.3	2 / 1	2012-12-05
0.4.2	2 / 1	2012-11-25
0.4.1	2 / 1	2012-11-02
0.4.0	2 / 1	2012-10-27
0.3.1	1 / 1	2012-09-22
0.3.0	1 / 1	2012-08-17
0.2.0	1 / 1	2012-08-16
0.1.0	1 / 1	2012-08-02
0.0.11	1 / 1	2012-07-18
0.0.10	0 / 1	2012-07-16
0.0.9	0 / 0	2011-06-20
0.0.8	0 / 0	2011-06-17
0.0.7	0 / 0	2011-06-14
0.0.6	0 / 0	2011-06-07
0.0.5	0 / 0	2011-05-20
0.0.4	0 / 0	2011-05-20

v0.9.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

2 findings

HIGH Publisher changed: tjholowaychuk → domenic (on 2013-02-16) provenance

This version was published by a different npm account than previous versions on 2013-02-16. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: domenic → tjholowaychuk (on 2013-02-05) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2013-02-05. This could indicate a legitimate maintainer transition or an account compromise.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.